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oF As it stands now your testimony doesn't 
involve Bitcoin; is that accurate? 

A. Yes, I haven't offered any expert opinions 
related to Bitcoin. 

on I guess it would be the same answer with 
regards to tracing of Bitcoin, you haven't offered any 
opinions in this case to date? 

A. COLLece 

Ox How about Bieeeda valuation, would that be the 
Same answer? 


A. COrrect.. 





CG. How about the Bitcoin protocol? 
MR. FREEDMAN: Objection. 
TIE WITNESS: Can you be more specific? 
BY MR. KASS: 
Q. Sure. To date have you offered any testimony 
about the Bitcoin protocol? 
A. No. 
©. I Just. Want to-clarify. For all these bast 
three questions where I asked about testimony I'm also 
including reports in this case. Would your answer be 
the same with that clarification? 
A. To my recollection I haven't submitted any 
written reports related to the Bitcoin protocol. 


OF Or the valuatron of Bitcoin er Lracing 
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1 Ba teeins Correct: 
2 MR. FREEDMAN: Objection, compound. 
5 Tet WLENESo:  COELeCU< 


4. BY MR. KASS: 





5 oe Have you ever been recognized as an expert in 
6 the forensic examination of documents? 

; | MR. FREEDMAN: Objection, ambiguous. 

8 THE WITNESS: Do you mean specifically within 
S) a COuULL: 


ds) BY MR. KASS: 


13 oF Let's break it down. Let's start off within a 
12 Cec 2 

dee) A. SO My Gxpertise rebated (oO the case 1 

14 testified about in 2017 involved a review of certain Web 
LS Sites. To the extent you consider that a document then 

LG Wes. 

17 Ok How about documents that aren't Web sites? 

18 A. To the best of my recollection it also 

19 involved a review of e-mails. 

20 oF What were you trying to do with those e-mails 


a1. in that case? 


22 A. In that case I believe it related to 

23 identifying “Ghee Oragim. of some of the e-maits. 

24 On All right. Were you trying to identify 
25 whether those e-mails were forged? 
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i A. No. 
2 Oa Were you trying to identify whether they were 
3 manipulated? 
4 A. That was a certain part of the analysis but 


5 not the ultimate objective. 

6 | G:. Have you ever been recognized as an expert in 
7 forensic examination of documents not in a court 

8 setting? 

9 A. To the extent I understand the guestion not to 


10 | my knowledge. 


mal Q. Prior to this engagement and that other 2017 
12 cases have you ever engaged in the forensic examination 
1.3 of documents? 

14 A. Yes ; 

15 ©. Where? Let's start with when? 

16 A. So certain consulting engagements from I would 
iy, estimate 2014 to the present involved forensic 

ale collection and examination of certain documents. 

19 ©: And how many times would you estimate you've 


20 done that? 


pa. A. I don't recall. I would estimate probably on 
22 the order of one to two dozen times. 

23 o* And when you were forensically examining those 
24 documents what was your ultimate goal? 

25 MR. FREEDMAN: Objection. 
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THE WITNESS: So much of the subject matter of 
those particular investigations related to 
1denkLiying ome ef Lhe particular type ef 
manipulations that may have been done to those 
documents often with malicious purposes as well as 
attempting to identify from whom those documents 
originated. 

BY MR. KASS: 

Q. Now, when you state malicious purposes is that 
akin to looking for mal ware? 

A. Yes, that was certainly part of It. 

Ou And did any of those engagements involve 
determining whether a document was forged? 

A. Certainly we were looking for identificrs that 
the documents may or may not have been manipulated. 

Op But the manipulations you were looking for 
primarily related to whether something malicious was 
inserted into that document? 

A. That's certainly part of it. 

Ox Dr. Edman, what's your -- how would you 
characterize your expertise? 

A. I would characterize my expertise in general 
as a computer scientist with particular focuses on 
computer security which includes digital forensic 


investigations and applied cryptography. 
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MR. KASS: Are your investigations primarily 
related to -- let's back up. Let's return to a 
previously introduced exhibit which was your expert 
report dated December 2013 of the previous year 
which I believe is Exhibit -- maybe we did not 
introduce it. We did not introduce it yet. It 
will be Exhibit 11. 

(Defendant's Exhibit No. 11 was 

marked for identification.) 

BY MR. KASS: 
Dr. Edman, do you recognize Exhibit 11? 
Yes. 


What is it? 


> Oo bP x 


Tt is an expert report that I submitted in 


this matter. 


QO. Dad, you, Submit 1c on December 13, 20197 

A. Ls « 

OF Tt you Leok to: page four of That expert 
report. Does that lay out your expertise in general or 


your working history? 

A. IT would just like to note for the record that 
I did previously state that this was my expert report 
but it does appear to contain handwritten notes that I 
did not make. 


O.. Let's swap that out. I mistakenly gave you my 
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i version. Now looking at Exhibit 11 does this appear to 
2 be a clean copy? 
3 A. L Witt eheek., Yes. 
4 Q. Can you turn to page four. Is that a summary 
5 of the work you have done -- of your work history? 
6 MR. FREEDMAN: When you said page four do you 
a mean paragraph one? 
8 MR. KASS: Page four. 
9 THE WITNESS: Page three also includes some of 
10 my work history. 
oth BY MR. KASS: 
1.2 Oo. On page three and four is a summary of your 
12 work history and is that accurate? 
14 A. Yes: 
15 Q. Could you show me where it refers to the 
16 forensic examination of documents? 
cy A. That would be generally covered by 
Le investigative analysis noted in paragraph six as well as 
i paragraph seven forensic evidence collection and 
20 analysis. 
2 il O.. And that would be when you worked at FTI? 
as A. Paragraph six refers to my current employer. 
ZS Q. Paragraph seven where you reference forensic 
24 evidence collection analysis is that when you were 


25 working at FTI? 
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ls A. Yee 

2 Ou; And what was that forensic evidence collection 
3 and analysis related to? 

4 A, It was similar to what I described before, 

5 responding to requests from clients regarding potential 

6 incidents. 

7 O- So what do you mean by potential incident? 

8 A. Potential security related incidents such as 

9 an intrusion or some type of attack or attempts to 
a0 defraud the company. 

ia Or Can we go step by step how that works. I 

ee assume somebody calls you up and says I believe 
‘Be someone's intruding my system. How does it work if you 


14 can just take me step by stcp? 


1:5 A. To be clear are you asking how we get work? 

dL Q. Well, what I mean what your work is starting 
de, from when someone contacts you. Would it be fair to say 
18 sometimes people contact you and state I believe someone 
19 has intruded my network or on to my network; correct? 

20 MR. FREEDMAN: Objection. 

Bi THE WITNESS: Yes, they may contact me. They 
DP may contact somebody that I work with. 


ZG BY MR. KASS: 


24 om But the nature of the request is I believe we 


25 had. 2m inmtrusitoen? 
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al Pree That would be the nature of some of the 
Z requests. I wouldn't say that's the nature of all 


3 requests that we get. 





A Oe Could some of your requests be related to I 

5 want make sure that my systems are secure so somebody 

6 can't get in? 

7 A. Yes, that may be part of it as well. 

8 ©. Are there any other requests that you receive 
9 or received and I'm specifically relating to paragraph 
10 seven just to be clear work you did at FTI? 

Li. A. ves< 

12 ©: So after you get one of those requests what do 


14 MR. FREEDMAN: Objection. 

15 THE WITNESS: Well, depends on the particular 
16 nature of the request. It could be an 

17 investigation that may include collection of 

18 relevant forensic artifacts such as forensic 

19 images, documents, logs and the such. 


20 BY MR. KASS: 


a Ox What are you trying to determine after 
pee, collecting those documents? 
23 A. Generally trying to determine, you know, 


24 whether there was a breach, the extent of the breach, 


25 perhaps the source, the cause and so on. 
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Q. Did it ever involve determining whether 
documents were forged as a result of that intrusion? 
A. Yes, that may be a component of some types of 
these investigations. 
@:; How many times do you estimate that has 
happened? 
MR. FREEDMAN: Objection. 
THE WITNESS: I don't recall exactly. 
BY MR. KASS: 
On Was it more than once? 
A. I would estimate again I would put the number 
between one and ten. 
Or. Would it also be between one and five? 
A. I don't recall. 
MR. FREEDMAN: Objection. 
BY MR. KASS: 
OF Have you ever determined that documents were 


in Tact medified as a result of an Intrusion? 


A. Yes. 
i. When you're doing your examination of those 
documents were you focusing -- was one thing that you 


were looking at was whether mal ware was placed into 
certain documents? 
Ax Can you say that again? 


Oy In those assignments where you were 
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1 investigating a potential breach and you stated you 

2 analyzed some documents; correct? 

2 A. res’. 

4 oF Was your analysis to determine whether mal 

5 ware was installed in certain documents? 

6 A. That is part of the analysis. 

7 O.. Did your analysis include determining whether 
8 certain documents were forged? 

g A. Yes’, 
10 MR. FREEDMAN: Objection. 


dle BY MR. KASS¢ 


ae, Q. How many times did you determine that a 

ies document was forged? 

14 A. Again I would put my recollection sometime 
Ls somewhere between one and ten. 

16 QO. Would it also be between one and three? 

Ly A. T don't recall. 

18 2, Between one and two? 

19 MR. FREEDMAN: Objection. 

20 THE WITNESS: Same answer. 


real BY MR. KASS: 


Ze O'. So you just know it was more than one and not 
Ze more than ten but any number in between could be? 
24 A. To the best of my recollection, yes. 


a5 MR. KASS: I want to just take a really quick 
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break. Let's go off the record for a minute. 





THR VIDEOGRAPHER: Off The record at 1Li205~ 

‘Daseussionm held ofr the record. ) 

THE VIDEOGRAPHER: Back on the record 11:12. 
BY MRE. KASS: 

oF Dr. Edman, we were previously talking about 
the work that you had done in FTI; correct? 

A. Yes. 

OF And I specifically asked you how many times 
you had conducted forensic analysis of a document to 
determine whether it was a forgery; correct? 

A. To the best of my recollection, yes. 

Or Now I want to ask you about your work at BRG, 
the Berkeley Research Group. [low many times have you 
conducted analysis to determine whether a document is a 
LOrGery 7 

A. Again I think I would have the same answer, 


approximately between one and ten. 


O. Could it be also between one and two? 

A. & don't reeall... 

QO. Is there a way for you to refresh your 
recollection? 

A. Yes. I believe I could go through possibly 


notes related to previous cases to the extent they 


ax 1st. 
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A. Yes. 

Or Is there any reason why you truncated the 
sentence in Exhibit 11, paragraph seven? 

A. Not. Ehat 1. recall. 

‘oF Did you want the Court to think you had a 
broader expertise in forensic evidence, collection and 
analysis? 

A. No. I don't recall why I removed that 
particular pare @f tie: senbenee. 

en But it was removed? 

MR. FREEDMAN: Objection. 
THE WITNESS: I can't say whether it was 
removed from this document or -- all I can say is 

that it is in Exhibit 12 and not in Exhibit 11. 


BY MR. KASS: 


©: And you don't know the reasons for the 
removal? 
A. Not that I recall. 


MR. FREEDMAN: Objection. 
BY MR. KASS: 
Q. You don't know the intention as to why it was 
removed? 
MR. FREEDMAN: Objection. 
THE WITNESS: Not that I recall. 


MR. FREEDMAN: Mischaracterizes the testimony. 
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i BY MR. KASS: 

2 Q. And these are both documents you drafted? 

3 A. Yes. 

4 O. Have you ever published any papers related to 
5 the forensic analysis of documents? 

6 A. No. I don't believe so. 

z OF Have you ever given any presentations related 
8 to the forensic analysis of documents? 

9 A. Not that I recall. 

10 0. Do you have any training related to the 

id forensic analysis of documents? 

12 A. Yes. 

13 ©). What type of training? 

ual AX. Well, I have a PhD. in Computcr Scicnce which 
15 provides the foundation for that sort of analysis. I 
1.6 have significant work experience that we discussed 

7 related to that type of analysis. I am also an access 
18 data certified examiner which is a type of forensic 

Lo Ceri ft peer @n. 
20 ©. All the experience you have related to 
al forensic examination of documents we've already 


22 discussed that. There's nothing else out there that I 


eee missed; is that accurate? 
24 A. Not that I recall as I sit here. 
DS ©. As a PhD. in computer forensics is there a 
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1 course on how to detect forgeries? 
2 A. I don't know. I don't have a PhD. in computer 
2 forensics. 
4 O's I'm sorry, in computer sciences you stated. 


5 What's your PhD. in? 


6 A. I stated my PhD. is in Computer Sclence. 
y oF In Computer Science is there any course or any 
8 subject related to determining 1f a document 1s a 


9 POrGery v 


la) MR. FREEDMAN: Objection. 

. THE WITNESS: I wouldn't say there is a 

ee specific course related to that to my knowledge. 
18 At least at the school that I attended. 


14 | BY MR. KASS: 


15 QO Did you have any focus in your PhHD.? 

16 A fos, 

17 QO. What was your focus? 

18 A My focus generally was on computer security. 


19 My masters was focused on both related to applied 


20 cryptography. My masters was focused on anonymous 
D1 communication systems and my PhD. was focused on 
De wireless security. 

28 o.. You stated that you have a certification 
24 related to the forensic analysis of documents? 

25 A. I don't believe that's what I stated. 
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O1. Let's see exactly. You stated that you have 
an access data -- you are an access data certified 
examiner which is a forensic certification. Is that 
what you stated? 

A. MeSs 

O.. What do you mean by a forensic certification? 

Re Tt relates to the forensic collection and 


analysis of forensic artifacts which includes documents. 

Q. As part of that certification to they teach 
you how to identify whether a document is a forgery? 

A. No. 

MR. FREEDMAN: Objection. 

BY MR. KASS: 

ey Do they teach you how to identify whether a 
document has been altered? 

A. No. 

©: How long does that certification take? 


A. Not that long. 


oO: If you had to guess around how long, 
approximate? 

A. Te: be Glear == 

Q. Let's break it down. How long did you have to 
study -- is there an exam to receive that certification? 

A. Yes ; 

oF How long does that exam take? 
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il A. I don't recall exactly. I believe there was a 
2 time limit. I think it's something like three hours. 
3 ©. Did you -- do you have to take any classes 


4 before taking that exam? 


5 Ps The classes -- there are classes offered but 


6 to my knowledge it's not required. 


A O-« So what do you need to do prior to taking that 
8 exam? 

9 MR. FREEDMAN: Objection. 

LO THE WITNESS: You need to know the subject 

mal matter before taking the exam. 


Le BY MR. KASS: 


12 On: Well, is the exam open to anybody? 

1,4 A. I don"t Précall Gxacily. I Bbelicve co but. L 
15 don't know the exact requirements. 

16 OD. Do they test whether you know the subject 
il matter before taking the exam? 

18 A. To the extent I understand your question no, 


19 there is no pretest before you take the test. 


20 oF What do they test on the exam? 

Zi By, To the best of my recollection they test the 
22 forensic processing, review of certain forensic images, 
22 extraction of documents, review of those documents for 
24 Partreular Intermal ron 

25 QO. Are they testing that you know how to use the 
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2 A. Yes, that's part of it. 
S QO). Do you know what percentage of it it is? 
4 A. Not that I recall. 
5 Ox, So in addition to testing whether you know how 
6 to use the software what else are they testing? 
f A. Your ability to extract certain information 
8 from forensic artifacts. 
9 ©. How do they test your ability to do that? 
10 MR. FREEDMAN: Objection. 
alle THE WITNESS: They provide you with a forensic 
ips: image and then you have to -- they ask you 
13 questions regarding artifacts within that image. 
14 BY MR. KASS: 
es on Using their software; correct? 
16 A. I believe the questions are designed that way 


17 but I also don't believe that you have to use their 


18 software to answer those questions. 

Lg On Did you use their software to answer the 

20 questions? 

eal A. Yeo’. 

ae 0. Did you use that software in this engagement? 
er) A. VSS. 

24 Qs. Did you use any additional software in this 
2s Sncagement ? 
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A. Yes: 
Q. What additional software did you use in this 
engagement ? 
A. IT used a lot of types of software. I used 


Microsoft Windows for example. 

Or. Okay. What other software did you use? 

A. I'm not sure I can provide you an exhaustive 
list. Microsoft Word was relevant. 

Q. Let me make this a little easier. In your 
determining whether a document was forged or altered 
what software did you use, not in drafting the report 
that's what I'm trying to make the distinction? 

A. To the extent I understand your question so to 
determine whether a document was manipulated I needed to 
extract certain features or artifacts from those 
documents. In order to do that I used a number of 
tools. One of them is a HEX Editor. That HEX Editor is 
called 010 editor. For reviewing certain e-mail files I 
used Microsoft Outlook. For extracting certain 
information from PDF files in addition to 010 editor I 
used a few common tools one is called PDFparcer.PY. 
Another called PDF Extreme Number. 

QO. Do you recall any additional software that you 


used? 


By I used GNU PG for the validation of certain 
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parse relevant bits of the PDF and then searched for 
this particular marked content point. 

0. Were you looking for any other marked content 
points or any other -- was there any other method that 
you used to identify documents that you wanted to look 


at further? 


A. Yes. 
Q. What methods did you use? 
A. Based on documents that I've already reviewed 


and determined that they are likely forgeries I also 
searched for document I.D.s associated with those 
particular documents. 

oF But would it be fair to state that the first 
process in all of this is that you run some software to 
identify the touch up text edits and then having after 
having identified the document you used the document 
I.D.s to identify related documents? 

A. I wouldn't say that's an exact description of 
the process. Different parts of the process. 

QO. Can you just state for the record what the 
process actually was? 

A. Sure so as I described the process for 
initially reviewing the natives include parsing them 
using PS Parcer.PY and searching for that particular 


marked content point. 
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a Separate from that there are certain documents 
2 that I had reviewed prior to having access to Relativity 
3 and for which we would identify document I.D.s 
4 associated with those documents and then searched within 
5 these native files for those document I1.D.s. 
6 0. Got it. How did you obtain those documents 


7 before you had access to Relativity? 


8 | A. Those documents would have been provided by 
9 counsel for the plaintiffs. 

10 Ce Were those hard copy documents? 

ims A. No. 

12 Os. Did they include any hard copy documents? 

LS A. No. Not to my knowledge. 

14 on Could you turn to page six of Exhibit 11 and 


5 if you could look at paragraph 18 I would like you to 

16 look at the last sentence that actually starts at the 

Ly beginning of page seven and what does it state the last 
18 sentence right above the image? 

Lg A. "IT also understand that this document was 

20 produced by the defendant as a scan of a hard copy paper 
PA. documemt Im this latigatzon." 

2? O'. Does that refresh your recollection whether 

2 you did in fact look at hard copy documents? 

24 A. I did not look at any hard copy documents that 


BS IT recall. 
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1 Oe So how do you know that that document was a 

Z scan of a hard copy document? 

3 A. That was represented to me by counsel for the 
4 plaintiffs. 

5 O» If you can turn to page eight. 

6 A. OF Exhiabit 1.1.7 

7 ©. Yes, please. You see at the top of the page 
8 it says "the two documents is identical to the version 
:) attached to the paper scans as Bates numbers 0002414-15 
10 that the defendants swore were authentic?" 

al. al A. Ver: 

2 Q. How did you determine that they were 

ie identical? 

14 A. I visually compared them. 

i§& On The "them" being those documents in the hard 
16 SOpy Coecunene? 

ila A. Them being I had an electronic copy of the 

18 hard copy document and also the electronic copies that I 
Lo extracted from 13451 and 14589. 
20 Q. Dr. Edman, what is a hard copy document? 
ih A. Hard copy document is a physical paper 
De document . 
23 ©. If I scan a hard copy document what do you 

24 call that? 
25 A. I would call that a digital copy of the hard 
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al GOpy Gostment - 

2 O Is that standard industry use? 

e A. I'm sorry, could you be a little more 

4 specific? 

5 O's Your nomenclature calling a printed document 

6 that was later scanned a digitally scanned version and 

7 no longer a hard copy is that industry standard? 

8 A. To the extent I understand your question yes, 
S) I believe that's the common nomenclature. 

dL.) Oe Do you know whether any hard copy documents 

deal were produced in this litigation? 

12 A. I understand that some may have been but I 

1.3 don't know for certain. 

14 OL Would you consider a hard copy document that 
ils was later scanned an ESI document? 

16 MR. FREEDMAN: Objection. 

iy, THE WITNESS: Could you please define what you 
18 mean by ESI document? 

iL BY MR. KASS? 
20 Q. What does ESI document mean to you? 

21 A. I don't know what the abbreviation means in 
ae thie’ ‘cOonLlext . 

23 Q. Do you know what it means in any context? 
24 A. Not that -- not to my recollection. 
25 OC». When you looked -- once you identified -- once 
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1 you identified a document that you wanted to look at for 
2 example a PDF that you wanted to look at further what 
2 would you look at, what was your process? 
4 MR. FREEDMAN: Objection. 
5 THE WITNESS: The methodology for reviewing a 
6 particular document such as PDF is described in my 
7 report which includes reviewing the content of the 
8 document, the internal structure, metadata 
9 associated with that document and the content of 
10 the document may include other things for further 
ial review such as cryptographic signature. 
‘lie MR. FREEDMAN: For the record I objected to 
al: question but I don't see it on the record. 
14 MR. KASS: Objection noted. 
ies BY MR. KASS: 
16 O;. Do PDFs have multiple data streams? 
ay A. they Cat 
18 oF Are there data streams that you looked at but 
19 did not include as exhibits to your report? 
20 A. T'm sure there were unrelated data streams 
oak contained in the PDF that aren't included in my report. 
22 QO. How did you determine they were unrelated? 
2S A. They didn't contain any information that 
24 influenced the opinion stated in my report. 
25 O:. But it 1s something that you looked at? 
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1 sending you hash values? 
> A. In one instance I believe there was and in 
3 another instance I believe this was ine@luded with the 


4 documents that they gave me. 


5 MR. KASS: So I'm also requesting the e-mail 
6 with the hash values that's something Dr. Edman 
7 considered in his report. 


8 BY MR. KASS: 
9 on Is there anything stopping you from providing 


10 that e-mail with the hash values? 


ileal. A. Not to my knowledge. 

12 Op. Did you have -- did you calculate your own 
1.8 hash values with regard to these documents? 

14 By, Again as I stated previously I used open SSL 


15 which is a tool for performing a number of cryptographic 
16 activities including hashing files. 

ila Q. So I'm just trying to understand how that tool 
18 works. Would it be accurate to state that that tool 


1,9 generates a hash of those documents? 


20 A. That tool generates a hash of yes, one or more 
aa. documents. 
22 QO. And then did you compare that hash with the 


23 hash you had provided by plaintiff's discovery vendors? 


24 Pye Yes. 


25 MR. KASS: I will request all the hashes you 
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a generated using that tool. 

2 BY MR. KASS:« 

3 om Is there anything stopping you from providing 
4 those hashes that you calculated? 

5 A. I don't believe that I have the hashes that I 
6 generated then but I can certainly generate hashes of 

7 documents as I have them now. 

8 O:. Why don't you have hashes of documents that 

9 you generated then? 

10 A. Because it was just a comparison at the time 
alia between a CSV and the output of open SSL. 

12 Oy When that output is -- in what form is the 

13 output generated? 

14 A. Wouldn't have been any output unless there was 
ES a difference. 

16 O. Let's just back up. My understanding of your 
lle, testimony 1S you generated your own hashes for those 

18 documents; correct? 

Le A. Tes. 
20 Os And you compared those hashes with the hashes 
yl. that were provided by plaintiff's vendor; correct? 
22 A. paeicun 
eee Oe Were -- the hashes that you generated how are 
24 they stored? 
25 A. To the best of my recollection they weren't 
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tL, | svoexred.. 


2 Q. So when the computer -- when the software 


3 generates the hash do you see that hash? 


4 A. In some instances, yes. 

5 Q How do you see it? 

6 A It prints it in a command prompt. 

7 @-. Did you save your command prompts? 

8 A No. 

9 On Do you have any record of the steps that you 
10 took when you were validating these documents? 
al Fil A. To the best of my knowledge I don't have any 
12 contemporaneous record, no. 
13 | O:., Is it possible for someone to replicate your 
14 work? 
1S A. I believe so, yes. | 
16 Q. How would somebody replicate your work? 
ig? A. By using -- well, by reviewing the same 

18 documents that I reviewed. By looking at the same 

19 metadata that I reviewed. Extracting the same 
20 cryptographic signatures. 
21 ©. But is there any way someone can be certain 
22 they're looking at the same exact version of the 
23 document that you were looking at when you conducted 
24 your analysis? 
on A. I mean they could compare the hash values. 
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d., QO. We wouldn't know the hash values of the 

2 document that you looked at? 

3 A. They were consistent with what the Relativity 
4 | vendor provided me. 

5 OF Right, but they can't independently verify the 


6 actual hash values of the documents you had looked at? 


”) A. Not to my knowledge. I'm sure there's some 

8 central source of truth from access -- I forget Alex 

2) Partners: Grom when Ehey were collected. 

130) om I'm just concerned about when you were sitting 
nae at your computer doing your analysis we cannot know 


12 definitively what the hash value of that document was at 


de) that point in time because we do not have those hash 
14 values. Is that correct? 

15 A. Again the hash values that I computed were 
16 consistent with what was provided to me so the hash 


|: 7) values of those documents would have been what was 


18 provided to me. 
19 QO. But if someone wanted to verify that they were 


20 in fact the same they wouldn't be able to? 


zal A. Not without the list of hash values. 

D2 O}. Which we don't have; correct? 

ZnS A. COrrect 

24 On, Would 1t be accurate to state that in your 

BS report which is Exhibit 11 you referenced many documents 
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1 that appear to be communications bctween Dr. Wright and 
Z Dave Kleiman? 

5 A. Les. 

4 ©: Did you analyze the documents that were 

5 produced by Dr. Wright to reach an opinion as to whether 
6 those documents were forged; correct? 

7] A. I don't know specifically who produced these 
8 documents. 

9 Or Well, have you looked at the Bates numbers on 
10 the documents that you looked at? 

iil A. Yes 
a Bee Or Did you analyze any documents that came from 
8 Dave Kleiman's device to see whether he had the other 
14 Side of the e-mail? | 
15 A. These would have been included in searches 

16 that I ran to -- in Relativity to the extent -- to the 
17 best of my recollection. 

13 Oke Do you know if Dave Kleiman's e-mails were 

19 included in Relativity? 
20 A. IT believe so but I don't know for certain. 
2 O.. What's the basis for your belief that it was 
22 included in relativity? 
23 A. I observed e-mails as a result of some of my 
24 searches that were sent by Dave Kleiman and to the best 
25 of my recollection didn't include Craig Wright as a 
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d. A. Ves... 
2 On What does it mean to you? 

3 A. It means following reasonable forensic 

4 processes and procedures when handling forensic 

5 evidence. 

6 Oz What are reasonable forensic processes when 
f, handling forensic evidence? 

8 A. I believe that would depend on the type of 

2) evidence. 

Lo | oF How about e-mails and PDFs? | 
shale A. With respect to -- can you be more specific? 
le, Ox, To determine whether they were altered or 

13 forged. 

14 A. So I believe that the methodology that I've 
15 described here is reasonable forensic process in 

16 reviewing these documents. 

La on So in your mind is forensic process the same 
18 thing as forensic methodology? 

19 A. As you're describing them yes, I believe so. 
20 ©... Are you aware of any best practices when it 
PA. comes to not even the methodology but reviewing 
22 documents to ensure that referring to the methodology 
23 that what you're doing is -- can be traced, that it's 
24 recorded and they're not -- you're not inadvertently 
ae altering anything throughout to your investigation? 
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] A. Can you restate the question, sorry? 
2 Q. That's fine. Are you aware of any best 


3 practices that somebody should take when they are 





4 forensically investigating documents to ensure that they 
5 are not inadvertently modifying the documents and 
6 nothing on their workstation is contaminating the 


7 documents throughout their analysis? 

8 A. Other than the reasonable and typical forensic 
9 practices such as verifying that the documents received 
10 was aS was intended. In some instances it may involve 


dle verifying that the output of for example extracting data 


il from a document is consistent between two tools. 

13 | On Are those all the processes that you're aware 
14 Ore 

ies A. As I sit here today and as it relates to the 


16 analysis that I performed, yes. 


17 O. Where did you perform your analysis on these 
18 documents? 

1.9 A. In numerous places. 

20 on Could you give me locations? 

pe, A. New York, New York. Miami, Florida. I 

22 believe I created some exhibits while in Lanai, Hawaii. 
22 eo. What computer did you work on when you 


24 performed this analysis? 


25 A. My BRG issued computer. 
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1 Oy. All three times? All three locations was on 
2 your BRG issued computer? 
3 A. Yes. I'm trying to recall whether I hada 


4 different BRG computer in mid 2019. I believe I may 


5 have but it was still a BRG issued computer. 


6 a. And was this computer used for other work 

7 aside from your work in connection with Exhibit 11 which 
8 is your expert report? 

o) A. Yes¢ 
190 QO Do you know what a clean test environment 18? 
11 A I believe so. 
12 Oz What is it? 
13 A An environment such as a computer or virtual 
14 machine that is in some known fixed statc. 
15 OF If you're using a machine for other things, 


16 other projects is that going to be a clean test 


17 environment? 

18 | Be No, unlikely. 

RS) Oy Is there a reason why you didn't use a clean 
20 test environment when you performed your analysis? 

21 A. No particular reason. It didn't seem to be a 
22 requirement for this type of analysis. 

28 Q. Although the result of the analysis you're 

oa determining certain documents were forged; correct? 

25 A. That is part of my opinion, yes. 
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a} O And altered? 

Z A Sorry, Cal you restate? 

3 Oe And altered? 

4 A Yes, I believe certain documents were altered. 
5 Q And not authentic? 

6 A Cor Lect. 

y Q. All that was done on a non-clean work 

8 environment? 

9 MR. FREEDMAN: Objection. 

10 THE WITNESS: It was done on my BRG issued 
ale laptop. 


We BY MR. KASS: 


13 OQ. Which was a non-clean work environment, 
14 GOrrec? 

15 MR. FREEDMAN: Objection. 

16 THE WLINESS: Sure. 


AL gf BY MR. KASS: 


18 ©. Did you use a write blocker when you obtained 
Le those documents? Let's back up. Do you know what a 


20 white blocker 18s? 


oa A. eS 

22 ©. What's a white blocker? 

23 A. A white blocker is a device that prevents 

24 modifications to a hard drive such as when removed from 
ES a, COMPULEer 2 
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1 On Did you use a white blocker when you were 

2 analyzing those documents? 

3 A. That question doesn't even make any sense. 
‘, Q. Well, you obtained documents from another 

5 source; correct? 

6 A. Yes 

i e.. Then one source of that was through the 

8 internet as an e-mail attachment? 

9 A. Yes . 

10 Q You downloaded it on to your computer? 

deal A. Yes. 

1Z O And you did your analysis; correct? 
L3 A Yes. 

14 ©. Would another way have been to obtain those 
15 documents from the discovery vendor on a USB drive? 
16 A. Yes, I suppose that's possible. 

7 O). They could have e-mailed it to you? 

18 MR. FREEDMAN: Objection. 


1g BY MR. KASS: 





20 on Mailed it to you? 
2 1. A. Restate the question. 
22 Oo. Sure. The discovery vendor could have mailed 


22 you that USB drive? 


24 A. I don't know the capabilities but I imagine 


Bis that that's possible. 
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O. And you could have plugged that USB drive into | 
a white blocker? 
A. Yes. 
©. And then you could have used the white blocker 


to take those documents from the USB drive to your 


COomoucex f 
A. Yes. 
©. And in doing that you would ensure you didn't 


inadvertently modify any of those documents while 
transferring them on to your computer? 
A. The process you described would just make sure 
I'm not doing inadvertently modifying documents that are 
on the USB drive that the vendor sent me. | 
on It would also enable you to confirm at the end 
that your process didn't modify anything; correct? 
MR. FREEDMAN: Objection. 
THE WITNESS: £Yes. 
BY MR« KASS? 
Q. Would you agree that the method of storing the 
document could impact the integrity of its metadata? 
A. I don't know. 
Oh. Do you consider yourself to be an expert in 
document metadata? 
A. I consider myself to be an expert in digital 


forensic investigation which may in some instances may 
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1 involve a review of metadata, ycs. 
2 Gi. You have no knowledge as to whether the manner 
3 in storing a document could impact the metadata? 
4 A. Again can you give me an example? 
5 Or. I'm just asking you. I want to know if 


6 metadata is static or if the way it's stored could 


7 somehow impact it. 


8 A. I imagine it's possible to store data in a way 


9 that could impact that data. 


150) Q. Do you have any information as to how the 

ial documents were stored from the date they were first 

le created until they appeared on your computer? 

ales A. ING 5 

14 @. Do you have any knowledge as to the chain of 
5 custody from when the document was collected until when 


16 you analyzed it? 

La A. Obviously I have some knowledge of the 

18 Relativity vendor providing me with documents or 

19 obtaining them from relativity but the chain of custody 
20 how they got from the original device to the Relativity 


21 vendor I can't say. 


OMe, on And you don't know for certain -- and you 

23 don't know for certain who collected the data, do you? 
24 A. Can you be more specific on which data? 

25 OF For all the documents that you looked at that 





www.uSlegalsupport.com 


Case 9:18-cv-80176-BB Document 500-4 Entered on FLSD Docket 05/09/2020 Page 37 of 41 


Matthew Edman 
January 16, 2020 96 


1 were obLained from Relativity, plaintiff's counsel, 


2 plaintiff's vendor do you know who collected that 


3 data -- data originally? 

4 A. NG. 

5 QO. If a document was moved from one server to 

6 another server could that impact its metadata? 

fi A. I imagine it would depend on how that document 
8 is moved. 

9 Q. Well, could you tell me a scenario where it 


150 would impact its data? 


11 A. Sorry, did you say would or would not? 

12 on Where it would. 

Le A. Depending on how that data is transferred 
14 perhaps there is some method for -- that would alter 


15 that data but I don't know exactly. I can't hypothesize 
16 what that would necessarily be. 

17 ©. But you would agree that there could be a 

18 scenario where transferring data from one server to 


19 another could alter its metadata? 


20 MR. FREEDMAN: Objection, speculation. 

2 il THE WITNESS: Anything is possible. 

op MR. FREEDMAN: When you get to a next break 
D3 maybe we can stop for lunch. 

24 MR. KASS: Actually we're getting very close. 
25D 
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o. 


have any idea as to what is the likelihood that that 


could happen? 


the particular method as to whether it would be 
likely that data would be corrupted or not. 
BY MR. KASS: 


Oe 


would in fact result in corrupting the data as you call 


tee 


BY MR. KASS: 
on 
documents you reviewed were in fact moved from one 
server to another server? 
A. 
O.. 
many times they were moved? 
A. 
Oh. 
to another storage media could that also affect 


metadata? 
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When you state anything is possible do you 


MR. FREEDMAN: Objection. 


THE WITNESS: Again I think it would depend on 


But you're not able to tell me what methods 


MR. FREEDMAN: Objection. 


THE WITNESS: No, not as I sit here today. 


Do you have any idea whether any of the 


I have no knowledge of that. 


You have no knowledge if they were moved how 


That's correct. 


Removing one document from one storage media 
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A. I think it would depend on the particular 

| metadata that you're talking about. I would say that 
it's possible but again it would depend on the 
particular situation that was used. 

oF Could it change document dates like create 
date? 

A. I think it would be unlikely to change 
document dates embedded in the document such as create 
date in the document metadata. 

O. But could it happen? 

A. Anything's possible. 

OF And you can't rule that out? 

MR. FREEDMAN: Objection. 
THE WITNESS: I have no reason to believe that 
that occurred but again anything is possible. 
BY MR. KASS: 

©. What if one file -- what if a document was 
moved from one file system to another file system could 
that impact its metadata? 

A. The metadata embedded in the documents I think 


it's unlikely that that metadata would be impacted. 


Q. BUG You can't, rule that our? 
A. Again anything is possible. 
©. That's why you Gan'’t. rule 1E— outs Gorréct? 


MR. FREEDMAN: Objection. 
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il THE WITNESS: Same answer. 
> MR. KASS: I think we can go off the record 
3 for now. 
4 THE VIDEOGRAPHER: Off the record at 12:30. 
5 (Thereupon, a brief lunch recess was taken.) 
6 THE VIDEOGRAPHER: On record 1:20. 
7 MR. KASS: All right. Vel, this is just 
8 continuing from the conversation we had before. I 


9 would like to put this on the record. 





10 | We are terminating Dr. Edman's deposition. As 
dei a basis for that discovery has been extended and 
12 it's my understanding that you cannot state with 


i3 certainty that Dr. Edman will not be submitting 


14 additional or any amendments to his report. If 

eS that's not accurate I will let you correct that 

16 after I'm done stating my basis. 

17 IT also want to note Mr. White is here. His 

18 deposition was scheduled for tomorrow. We already 
Lg moved it once from today to tomorrow to accommodate 


20 and supplemental report that was submitted by Dr. 


2 1. Edman on Monday and now plaintiff has stated 


22, because of the extension of discovery they are 

23 canceling Mr. White's deposition which is scheduled 
24 for tomorrow. We are doing the same. 

2S Vel, if you would like to put anything on the 
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record now is your chance. 

MR. FREEDMAN: Yes, we object. Dr. Edman is 
here. His deposition has started for I think it's 
two hours and 20 minutes already. That is 
different than Mr. White's deposition who has 
not -- it has not even started yet. 

Also we cannot state with certainty that Dr. 
Edman will not supplement his report. That's 
partly due to the fact that you have dumped 20,000 
documents on us yesterday. Also due to the fact 
that we have agreed with you, we offered to you 
that if he does supplement his opinion that we 
would attempt to reach agreement on the amount of 
time, you weuld be able, £6 re-depore im. 

Tt is our position that terminating an ongoing 
deposition is inappropriate; that by terminating 
this deposition you are waiving the right to depose 
him again and we also argue that because you won't 
represent on the record that you are done 
questioning him you're preventing me from taking a 
cross examination or redirect examination of Dr. 
Edman. 

There are things that need to be cleaned up in 
this deposition that _— are preventing me from 


doing and therefore our position is also that you 
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